Bug #79618 [NEW]: PHP: checkdate does not validate input

From: adam dot engle at adventhealth dot com Operating system: Unix/OSX PHP version: 7.4.6 Package: Date/time related Bug Type: Bug Bug description:PHP: checkdate does not validate input Description: ------------ --- From manual page: https://php.net/function.checkdate --- echo "<?php var_dump(checkdate(12, 31, '2000<script>alert(1)</script>'));" | php bool(true) echo "<?php var_dump(checkdate('12<script>alert(1)</script>', 31, 2000));" | php bool(true) Test script: --------------- <?php //Assume year is received via unvalidated input $post_year_val = '2000<script>alert(1)</script>'; if (!checkdate(12, 1, $post_year_val)) { $nowArray = getdate(); $month = $nowArray['mon']; $year = $nowArray['year']; } else { $month = 12; $year = $post_year_val; } $display_block = "<html><head/><body>"; $calendardate = $year."-".$month."-01"; $display_block .= $calendardate; $display_block .= '</body></html>'; echo $display_block; Expected result: ---------------- If input is not a valid integer as an input parameter, the function should fail closed, returning false. Otherwise, unintended consequences could result if a developer assumes the input provided to this function creates a valid date. Actual result: -------------- PHP 7.4.6 does provide a notice that it did not receive a well-formed int, however, it continues processing anyway if a date can be devised from the string, failing open and returning true. -- Edit bug report at https://bugs.php.net/bug.php?id=79618&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=79618&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=79618&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=79618&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=79618&r=needscript Try newer version: https://bugs.php.net/fix.php?id=79618&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=79618&r=support Expected behavior: https://bugs.php.net/fix.php?id=79618&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=79618&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=79618&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=79618&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=79618&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=79618&r=dst IIS Stability: https://bugs.php.net/fix.php?id=79618&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=79618&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=79618&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=79618&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=79618&r=mysqlcfg